I have a field called "date"(2016-07-21) and a field called "countdown"(e.g. 30) which shows the number of days. How do I add the days to the date?
eval inputDate=strptime(date, "%Y-%m-%d") | eval expiring=relative_time(inputDate, "+30d@d") | eval expiring=strftime(expiring,"%Y-%m-%d")
Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:
| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")
I meant to put "+countdown@d" instead of "+30d@d"
Probably the easiest way is to convert date to epoch in inputDate and then simply multiply countdown by the number of seconds in a day:
| eval inputDate = strptime(date, "%Y-%m-%d")
| eval expiring = inputDate + countdown*86400
| eval expiring = strftime(expiring, "%Y-%m-%d")
Works perfectly. Thanks! I was trying to find a Splunk feature that'll convert the days to epoch but, I wasn't thinking of just multiplying it. Haha.